ObsidiumV1300ObsidiumSoftware

Hunt Hypothesis

This detection identifies the presence of Obsidium software components within the environment to establish a baseline for legitimate application behavior and detect potential unauthorized installations or persistence mechanisms. Proactively hunting for this signature in Azure Sentinel allows the SOC team to validate known good assets against unexpected execution patterns, thereby reducing noise from false positives while ensuring that any deviations indicating adversary activity are promptly investigated.

YARA Rule

rule ObsidiumV1300ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 [4] E8 29 00 00 00 }
	$a1 = { EB 04 [4] E8 ?? 00 00 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the ObsidiumV1300ObsidiumSoftware detection rule, including suggested filters and exclusions:

• Scenario: Automated Patch Deployment via SCCM/Intune

  • Context: The enterprise uses Microsoft Endpoint Configuration Manager (SCCM) or Intune to push Obsidium software updates during the nightly maintenance window. The YARA rule triggers when the update installer (ObsidiumSetup.exe) executes on hundreds of workstations simultaneously, mistaking the mass deployment for a potential lateral movement or unauthorized installation event.
  • Filter/Exclusion: Create an exclusion based on the Process Parent Name and User Account. Filter out events where ParentImage contains ccmsetup.exe (SCCM) or IntuneManagementExtension.exe, AND the AccountName is a known service account (e.g., DOMAIN\ObsidiumDeploySvc).

• Scenario: Scheduled Data Backup Job

  • Context: A nightly scheduled task runs on the file server to archive logs using Obsidium’s native backup utility. This job executes as a Windows Task Scheduler trigger, launching the Obsidium engine which matches the YARA signature. The rule flags this recurring background activity as a new software installation or suspicious execution.
  • Filter/Exclusion: Exclude events where the ProcessCommandLine contains specific backup keywords (e.g., /backup, /archive) and the ImagePath resides in a dedicated system directory (e.g., C:\Program Files\Obsidium\bin\). Additionally, exclude triggers occurring during the defined maintenance window (e.g., 02:00 – 04:00 local time).

• Scenario: Admin Manual Installation via GPO

  • Context: The IT Operations team performs a manual rollout of Obsidium to new user workstations using Group Policy Objects